tag:blogger.com,1999:blog-8875668111631820725.post5677965452099349335..comments2018-09-23T07:16:38.876-04:00Comments on A Fistful of Dongles: Microsoft Windows File System TunnelingEric Huberhttp://www.blogger.com/profile/03501931630996986857noreply@blogger.comBlogger9125tag:blogger.com,1999:blog-8875668111631820725.post-71405799024948073552013-08-14T14:18:17.830-04:002013-08-14T14:18:17.830-04:00Hi Eric,
After reading your blog,I have been t...Hi Eric,<br /> After reading your blog,I have been trying to go deeper in this concept &amp; also doing some practical stuff on my PC to get it more clear.<br />I would really appreciate if you please help me following queries.<br /><br /> Suppose NTFS Tunneling is enabled.lets take an example say a.txt is created under ABC folder.then i deleted a.txt.(Please correct me if i am wrong ,here pramodhttps://www.blogger.com/profile/05440216414900010602noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-87585575840351492342013-07-30T02:41:43.384-04:002013-07-30T02:41:43.384-04:00Eric-Great work thanks for introducing this proble...Eric-Great work thanks for introducing this problem<br />-pramodpramodhttps://www.blogger.com/profile/05440216414900010602noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-58157190000914294822013-05-17T20:57:53.935-04:002013-05-17T20:57:53.935-04:00These are excellent questions and I wish I remembe...These are excellent questions and I wish I remember enough about the research I did at the time to answer them. For example, I could have *sworn* I checked the $File_Name aspect of this when I ran into this issue, but I can&#39;t find any notes that I took. The rub was that at the time I was concentrating on the Adobe Flash Cookies research and this was just a roadblock in creating a Eric Huberhttps://www.blogger.com/profile/03501931630996986857noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-37810489679706642222013-05-06T18:37:26.341-04:002013-05-06T18:37:26.341-04:00Hey Eric, Question for you... Does this tunneled c...Hey Eric, Question for you... Does this tunneled creation date get set when the new file is initially created, or is the correct creation time written, then changed to the old date? I&#39;m wondering whether the filename timestamps are affected. If it&#39;s written, then changed, I&#39;d expect the filename timestamps to reflect the actual creation time for the new file. Otherwise, they&#39;ll John McCashhttps://www.blogger.com/profile/16894873838018261992noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-90940622288648123152013-03-30T23:12:31.345-04:002013-03-30T23:12:31.345-04:00Another excellent explanation. Thank you. Another excellent explanation. Thank you. Bill O'Sullivanhttps://www.blogger.com/profile/15892463252714005835noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-2650603308938187082013-03-07T21:30:15.361-05:002013-03-07T21:30:15.361-05:00Eric, very interesting and a good post!Eric, very interesting and a good post!DBrushhttps://www.blogger.com/profile/12603125812433715546noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-53143601183205948472013-02-26T08:51:57.510-05:002013-02-26T08:51:57.510-05:00Very good post, bookmarked...Very good post, bookmarked...Luigihttps://www.blogger.com/profile/08012615697910098483noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-90261676938947706152013-02-25T11:17:12.175-05:002013-02-25T11:17:12.175-05:00Good post, Eric. I&#39;ve discussed this in my bo...Good post, Eric. I&#39;ve discussed this in my book, blog, and courses for some time, as it&#39;s very important for analysts to understand what actions or events create or modify various artifacts on the system. This is particularly true in timeline analysis, as this information helps provide much needed context.<br /><br />I would suggest that if you were to test this on Windows 7, you would Keydet89https://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-8875668111631820725.post-67074775347892903762013-02-25T06:53:04.824-05:002013-02-25T06:53:04.824-05:00Eric - great stuff! I bookmarked it as something ...Eric - great stuff! I bookmarked it as something that I know I&#39;ll come back to someday. One of those why does that happen again?&#39; posts.Rotomanhttps://www.blogger.com/profile/12876721819721389415noreply@blogger.com